From 92cb9fa1301e88ab1f9cdf1de016b1886e077ec4 Mon Sep 17 00:00:00 2001 From: Karthik Kantamneni Date: Tue, 1 Jun 2021 09:30:34 +0530 Subject: [PATCH] qcacld-3.0: Fix use after free during RX thread enqueue Currently nbuf is being used to get gso segments after enqueue to DP RX thread, this will lead to use after free issue because RX thread may process and even free the buffer by the time nbuf is accessed for getting gso segments in enqueue/softirq context. Fix this by updating gso segments before nbuf enqueue to DP RX thread. Change-Id: I2cc93bf9a44e2d487c1a6d474349cf5c0c5db76a CRs-Fixed: 2958132 --- core/dp/txrx3.0/dp_rx_thread.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/core/dp/txrx3.0/dp_rx_thread.c b/core/dp/txrx3.0/dp_rx_thread.c index 5324d89d5265..0df9d1247d57 100644 --- a/core/dp/txrx3.0/dp_rx_thread.c +++ b/core/dp/txrx3.0/dp_rx_thread.c @@ -276,10 +276,10 @@ static QDF_STATUS dp_rx_tm_thread_enqueue(struct dp_rx_thread *rx_thread, num_elements_in_nbuf--; next_ptr_list = head_ptr->next; qdf_nbuf_set_next(head_ptr, NULL); - qdf_nbuf_queue_head_enqueue_tail(&rx_thread->nbuf_queue, - head_ptr); /* count aggregated RX frame into enqueued stats */ nbuf_queued += qdf_nbuf_get_gso_segs(head_ptr); + qdf_nbuf_queue_head_enqueue_tail(&rx_thread->nbuf_queue, + head_ptr); head_ptr = next_ptr_list; }